I am setting up a Linux home gateway box -- replacing a Windows system.
I was a bit more skilled in the windows enivronment, I could use some
input for a piece of this Linux migration.
I want to provide secure remote access to my internal LAN. The remote
clients will include a windows box at my office. I thought that IPsec
using FreeS/WAN might be the most flexible way to do this.
Studying a variety of help/how-to documents, including Nate Carlson's
frees/wan <-> win2k doc, it appeared that to do this successfully I
would need the following on the Linux side:
- FreeS/WAN
- The X.509 FreeS/WAN patch
I have (I believe) successfully installed both, including the requisite
kernel rebuild. I then started to follow Nate's and FreeS/WAN's and
X.509 Patch's configuration documents.
I am now in pain.
For starters, when I start FreeS/WAN - using any of the configuration
scenarios the various authors discuss - FreeS/WAN installs a _2nd_
default route into my routetable. That entry immediately breaks the
forwarding of packets from my internal home machines out to the Internet.
Routing table before I perform start ipsec:
===========================================
Destination Gateway Genmask Flags Iface
63.197.148.0 0.0.0.0 255.255.255.0 U eth0
192.168.11.0 0.0.0.0 255.255.255.0 U wlan0
192.168.10.0 0.0.0.0 255.255.255.0 U eth1
127.0.0.0 0.0.0.0 255.0.0.0 U lo
0.0.0.0 63.197.148.254 0.0.0.0 UG eth0
Routing table after I perform start ipsec:
==========================================
Kernel IP routing table
Destination Gateway Genmask Flags Iface
63.197.148.0 0.0.0.0 255.255.255.0 U eth0
63.197.148.0 0.0.0.0 255.255.255.0 U ipsec0
192.168.11.0 0.0.0.0 255.255.255.0 U wlan0
192.168.10.0 0.0.0.0 255.255.255.0 U eth1
127.0.0.0 0.0.0.0 255.0.0.0 U lo
0.0.0.0 63.197.148.254 128.0.0.0 UG ipsec0
128.0.0.0 63.197.148.254 128.0.0.0 UG ipsec0
0.0.0.0 63.197.148.254 0.0.0.0 UG eth0
As soon as this second 0.0.0.0 routing entry is created, all
LAN->Internet forwarded packets attempt to go out ipsec0 and are
immediatley dropped by my IPTables configuration.
There is something fundamental about how FreeS/WAN is supposed to work
that I don't understand. I would expect a routing entry, to ipsec0,
that represents a simulated LAN on the far end of a VPN pipe, but I
don't expect an entry that routes all traffic to ipsec. I must be
missing something fundamental. (It irks me that the above tutorials say
little, if anything, about the routing table.)
Any help and advice would be appreciated. (In case your wondering, the
freeswan.org list server appears to not be accepting join requests right
now, which is why I'm looking here first for support. Plus, there are
some really experienced folks on this list!)
Thank you.
Andy Schwartz